Dormant MakerDAO auction-keeper bot: ~200 WETH emptied
Update
CertiK: unprotected function took over the keeper Maker account
08 Oct Grok window: CertiK says one function on the third-party keeper had no access check, so an outside contract could be granted full control of the keeper's MakerDAO account.
The attacker settled four 50-ETH lots left from March 2020 Black Thursday zero-bid wins and withdrew collateral in one transaction. The delegation was never revoked.
Other privileged functions were guarded, which is why the gap sat for years. Proceeds went to Tornado Cash in 10-ETH deposits. MakerDAO / Sky core still not at fault.
06 Oct 2026: Defimon and SlowMist flagged a 2020-era third-party MakerDAO ETH-A liquidation keeper bot emptied of about 200 WETH (~$538k–$543k). The upgradeable proxy had won four auctions in 2020 but never finalized them.
Its withdrawal path had no access control, so a Tornado-funded address could settle the old lots and take the collateral. Firms stress MakerDAO core behaved as designed; the flaw was in the abandoned third-party bot.
No owner statement or recovery. Research snapshot from Defimon, SlowMist Hacked, and related flashes.
369 take
Forgotten contracts with residual balances are a standing bounty. If you run keepers, bots, or adapters, revoke dead permissions and empty leftover collateral before you walk away.
Maker core was not the bug on this sample.
Sources